@voxgig/sdkgen 4.34.0 → 4.34.2

package/project/.sdk/src/cmp/rust/TestEntity_rust.ts

@@ -1,4 +1,4 @@
-import { flowSteps } from '@voxgig/sdkgen'
+import { flowSteps, opReachable, invalidRequest } from '@voxgig/sdkgen'
 
 import {
   KIT,
@@ -20,7 +20,8 @@ import {
   getMatchEntries,
   isAuthActive, envName, envToken,
   serverVarEnv,
-  serverVariables
+  serverVariables,
+  liveFlowNeeds, liveStrict, liveStrictNote,
 } from '@voxgig/sdkgen'
 
 
@@ -38,6 +39,54 @@ type GenCtx = {
 type OpGen = (ctx: GenCtx, step: ModelEntityFlowStep, index: number) => void
 
 
+// The live prologue of a flow built from offline fixtures: blocked without
+// the ids it binds, a create-less load reading the first listed record, and
+// a lenient run observing its checks rather than failing on them.
+function liveFlowGate(entity: any, needs: any, entidEnv: string, method: string,
+  strict: boolean, hasSteps: boolean): string {
+  let out = ''
+  if (0 < needs.keys.length) {
+    out += `    if setup.live {
+        for live_key in [${needs.keys.map((k: string) => JSON.stringify(k)).join(', ')}] {
+            if setup.synthetic_only || getp(&setup.idmap, live_key).is_noval() {
+                live_miss(LIVE_STRICT, &format!("Live entity test blocked: needs {} via ${entidEnv}", live_key));
+                return;
+            }
+        }
+    }
+`
+  }
+  if (null != needs.blocked) {
+    out += `    if setup.live {
+        live_miss(LIVE_STRICT, ${JSON.stringify('Live entity test blocked: ' + needs.blocked)});
+        return;
+    }
+`
+  }
+  if (!hasSteps) {
+    return out
+  }
+  out += '    let client = setup.client.clone();\n'
+  if (null != needs.discover) {
+    const match = Object.entries(needs.discover)
+      .map(([k, v]: any) => `(${JSON.stringify(k)}, getp(&setup.idmap, ${JSON.stringify(v)}))`).join(', ')
+    out += `    if setup.live && !live_existing(&setup.data, LIVE_STRICT, ${JSON.stringify(entity.name)}, || {
+        client
+            .${method}(Value::Noval)
+            .list(jo(vec![${match}]), Value::Noval)
+            .map(|list| ja(list.iter().map(|e| e.data(None)).collect::<Vec<Value>>()))
+    }) {
+        return;
+    }
+`
+  }
+  if (!strict) {
+    out += '    let outcome = std::panic::catch_unwind(std::panic::AssertUnwindSafe(|| {\n'
+  }
+  return out
+}
+
+
 const TestEntity = cmp(function TestEntity(props: any) {
   const ctx$ = props.ctx$
   const model: Model = ctx$.model
@@ -85,6 +134,9 @@ const TestEntity = cmp(function TestEntity(props: any) {
 
   const genCtx: GenCtx = { model, entity, rustcrate, flow: basicflow, PROJUPPER }
 
+  const strict = liveStrict(model, target.name)
+  const needs = liveFlowNeeds(entity, basicflow)
+
   const opNames = Array.from(new Set(allSteps.map((s: any) => s.o).filter(Boolean)))
   const opsList = opNames.map(o => `"${o}"`).join(', ')
 
@@ -130,6 +182,9 @@ use ${rustcrate}::core::helpers::{getp, getpath, ja, jo, now_ms, setp, to_map};
 use ${rustcrate}::utility::voxgigstruct as vs;
 use ${rustcrate}::{test_sdk, Entity, ${model.const.Name}Entity, ${model.const.Name}SDK, Value};
 
+${liveStrictNote(strict, '//')}
+const LIVE_STRICT: bool = ${strict};
+
 #[test]
 fn ${evar}_entity_instance() {
     let testsdk = test_sdk(Value::Noval, Value::Noval);
@@ -138,10 +193,10 @@ fn ${evar}_entity_instance() {
 }
 `)
 
-    // The stream test drives the list op; only emit it when the entity has a
-    // list op (a create/load-only entity has no list endpoint, so
-    // stream("list") panics with point_no_points).
-    const flowHasList = allSteps.some((s: any) => 'list' === s.o)
+    // The stream test drives the list op with no match; only emit it when a
+    // bare call can reach a list route (see helpers/opShape opReachable).
+    const flowHasList = allSteps.some((s: any) => 'list' === s.o) &&
+      opReachable((entity.op as any)?.list, [])
     if (flowHasList) {
       Content(`
 #[test]
@@ -186,17 +241,14 @@ fn ${evar}_entity_stream() {
 `)
     }
 
+    Content(failureTests(rustcrate, entity, evar, method))
+
     Content(`
 #[test]
 fn ${evar}_entity_basic() {
     let setup = ${evar}_basic_setup(Value::Noval);
-${skipBlock}    // The basic flow consumes synthetic IDs from the fixture. In live mode
-    // without an *_ENTID env override, those IDs hit the live API and 4xx.
-    if setup.synthetic_only {
-        eprintln!("skip: live entity test uses synthetic IDs from fixture — set ${PROJUPPER}_TEST_${ENTUPPER}_ENTID JSON to run live");
-        return;
-    }
-${allSteps.length > 0 ? '    let client = setup.client.clone();\n' : ''}`)
+${skipBlock}${liveFlowGate(entity, needs, PROJUPPER + '_TEST_' + ENTUPPER + '_ENTID', method, strict,
+  allSteps.length > 0)}`)
 
     // No create step: bootstrap entity data from existing fixture data.
     const flowHasCreate = allSteps.some((s: any) => s.o === 'create')
@@ -222,7 +274,11 @@ ${allSteps.length > 0 ? '    let client = setup.client.clone();\n' : ''}`)
       }
     })
 
-    Content(`}
+    Content(`${strict || 0 === allSteps.length ? '' : `    }));
+    if let Err(err) = outcome {
+        live_observe(err, setup.live, LIVE_STRICT);
+    }
+`}}
 
 `)
 
@@ -268,9 +324,8 @@ ${allSteps.length > 0 ? '    let client = setup.client.clone();\n' : ''}`)
     )
     .unwrap_or_else(|_| Value::empty_map());
 
-    // Detect ENTID env override before env_override consumes it. When live
-    // mode is on without a real override, the basic test runs against
-    // synthetic IDs from the fixture and 4xx's.
+    // Whether *_ENTID supplied the idmap, read before env_override consumes
+    // it: without it, the ids a live flow binds are the fixture's synthetic ones.
     let entid_env_raw = std::env::var("${PROJUPPER}_TEST_${ENTUPPER}_ENTID").unwrap_or_default();
     let idmap_overridden =
         !entid_env_raw.trim().is_empty() && entid_env_raw.trim().starts_with('{');
@@ -672,6 +727,98 @@ const GENERATE_OP: Record<string, OpGen> = {
 }
 
 
+// A failed operation fails a stream as it fails the operation: a transport
+// failure, and a hook that rejects the call. The caller's ctrl stays its own.
+// An invalid request fails with validate's own error, before it is sent. A
+// rust hook cannot throw, so there is no throwing-hook case.
+function failureTests(rustcrate: string, entity: ModelEntity, evar: string, method: string): string {
+  const feature = (name: string) =>
+    `getp(&getp(&${rustcrate}::make_config(), "feature"), "${name}").is_noval()`
+  let out = ''
+
+  if (opReachable((entity.op as any)?.list, [])) {
+    out += `
+#[test]
+fn ${evar}_entity_stream_error() {
+    let offline = jo(vec![("net", jo(vec![("offline", Value::Bool(true))]))]);
+    let err = test_sdk(offline.clone(), Value::Noval)
+        .${method}(Value::Noval)
+        .stream("list", Value::empty_map(), Value::empty_map())
+        .err()
+        .expect("a failed operation should fail the stream");
+    assert!(err.msg.contains("offline"), "{}", err.msg);
+
+    let quiet = jo(vec![("ctrl", jo(vec![("throw", Value::Bool(false))]))]);
+    assert!(test_sdk(offline, Value::Noval)
+        .${method}(Value::Noval)
+        .stream("list", Value::empty_map(), quiet)
+        .is_ok());
+
+    if !${feature('rbac')} {
+        let denied = test_sdk(Value::Noval, jo(vec![(
+            "feature",
+            jo(vec![("rbac", jo(vec![("active", Value::Bool(true)), ("deny", Value::Bool(true))]))]),
+        )]));
+        let denyerr = denied
+            .${method}(Value::Noval)
+            .stream("list", Value::empty_map(), Value::empty_map())
+            .err()
+            .expect("a denied operation should fail the stream");
+        assert_eq!(denyerr.code, "rbac_denied");
+    }
+}
+
+#[test]
+fn ${evar}_entity_stream_ctrl() {
+    let explain = Value::empty_map();
+    let ctrl = jo(vec![("explain", explain.clone())]);
+    let items: Vec<Value> = test_sdk(Value::Noval, Value::Noval)
+        .${method}(Value::Noval)
+        .stream("list", Value::empty_map(), jo(vec![("ctrl", ctrl.clone())]))
+        .expect("stream failed")
+        .collect();
+    assert!(getp(&ctrl, "stream").is_noval(), "the stream changed the caller's ctrl");
+    let filled = match &explain {
+        Value::Map(m) => !m.borrow().is_empty(),
+        _ => false,
+    };
+    assert!(filled, "the caller's explain record was not filled");
+}
+`
+  }
+
+  const bad = invalidRequest(entity)
+  if (null != bad) {
+    const args = Object.entries(bad.args)
+      .map(([k, v]) => '(' + JSON.stringify(k) + ', ' +
+        ('number' === typeof v ? 'Value::Num(' + v + '.0)' :
+          'boolean' === typeof v ? 'Value::Bool(' + v + ')' :
+            'Value::str(' + JSON.stringify(v) + ')') + ')')
+      .join(', ')
+    out += `
+#[test]
+fn ${evar}_entity_validate() {
+    if ${feature('validate')} {
+        return;
+    }
+    let client = test_sdk(Value::Noval, jo(vec![(
+        "feature",
+        jo(vec![("validate", jo(vec![("active", Value::Bool(true))]))]),
+    )]));
+    let err = client
+        .${method}(Value::Noval)
+        .${bad.op}(jo(vec![${args}]), Value::Noval)
+        .err()
+        .expect("an invalid request should fail");
+    assert_eq!(err.code, "validate_failed");
+}
+`
+  }
+
+  return out
+}
+
+
 export {
   TestEntity
 }

package/project/.sdk/src/cmp/rust/fragment/Entity.fragment.rs

@@ -143,10 +143,13 @@ impl EntyClass {
             _ => Value::empty_map(),
         };
 
-        let ctrl = match to_map(&getp(&stream_opts, "ctrl")) {
-            Value::Map(m) => Value::Map(m),
-            _ => Value::empty_map(),
-        };
+        // A copy: the caller's ctrl gains no key, and explain stays its own record.
+        let ctrl = Value::empty_map();
+        if let Value::Map(m) = to_map(&getp(&stream_opts, "ctrl")) {
+            for (k, v) in m.borrow().iter() {
+                setp(&ctrl, k, v.clone());
+            }
+        }
         setp(&ctrl, "stream", stream_opts.clone());
 
         // `args` carries the op's request match (list/load); pass it through
@@ -180,31 +183,42 @@ impl EntyClass {
             *ctx.reqdata.borrow_mut() = reqdata;
         }
 
-        // Run the same pipeline as run_op. A step's error does not pass
-        // through make_error here, so it and the explain record are cleaned
-        // on the way out.
-        let fail = |e: ProjectNameError| {
-            self.utility.clean_explain(&ctx);
-            crate::utility::clean::clean_error(&ctx, e)
-        };
+        // Run the same pipeline as run_op. A failed step leaves through
+        // make_error, as an operation's does.
+        let fail = |e: ProjectNameError| self.utility.make_error(&ctx, Some(e)).map(stream_items);
         self.utility.feature_hook(&ctx, "PrePoint");
-        let point = self.utility.make_point(&ctx).map_err(fail)?;
+        let point = match self.utility.make_point(&ctx) {
+            Ok(p) => p,
+            Err(e) => return fail(e),
+        };
         ctx.out_set("point", crate::core::types::OutVal::Val(point));
 
         self.utility.feature_hook(&ctx, "PreSpec");
-        let spec = self.utility.make_spec(&ctx).map_err(fail)?;
+        let spec = match self.utility.make_spec(&ctx) {
+            Ok(s) => s,
+            Err(e) => return fail(e),
+        };
         ctx.out_set("spec", crate::core::types::OutVal::Spec(spec));
 
         self.utility.feature_hook(&ctx, "PreRequest");
-        let resp = self.utility.make_request(&ctx).map_err(fail)?;
+        let resp = match self.utility.make_request(&ctx) {
+            Ok(r) => r,
+            Err(e) => return fail(e),
+        };
         ctx.out_set("request", crate::core::types::OutVal::Response(resp));
 
         self.utility.feature_hook(&ctx, "PreResponse");
-        let resp2 = self.utility.make_response(&ctx).map_err(fail)?;
+        let resp2 = match self.utility.make_response(&ctx) {
+            Ok(r) => r,
+            Err(e) => return fail(e),
+        };
         ctx.out_set("response", crate::core::types::OutVal::Response(resp2));
 
         self.utility.feature_hook(&ctx, "PreResult");
-        let result = self.utility.make_result(&ctx).map_err(fail)?;
+        let result = match self.utility.make_result(&ctx) {
+            Ok(r) => r,
+            Err(e) => return fail(e),
+        };
         ctx.out_set("result", crate::core::types::OutVal::Result(result));
 
         self.utility.feature_hook(&ctx, "PreDone");
@@ -221,16 +235,21 @@ impl EntyClass {
             }
         }
 
-        let data = self.utility.done(&ctx)?;
-        let items: Vec<Value> = match data {
-            Value::List(l) => l.borrow().iter().cloned().collect(),
-            Value::Noval | Value::Null => Vec::new(),
-            other => vec![other],
-        };
-        Ok(items.into_iter())
+        self.utility.done(&ctx).map(stream_items)
     }
 }
 
+// The items of what done or make_error hands back: under `throw: false` a
+// failure hands back the data there is.
+fn stream_items(data: Value) -> std::vec::IntoIter<Value> {
+    let items: Vec<Value> = match data {
+        Value::List(l) => l.borrow().iter().cloned().collect(),
+        Value::Noval | Value::Null => Vec::new(),
+        other => vec![other],
+    };
+    items.into_iter()
+}
+
 impl Entity for EntyClass {
     fn get_name(&self) -> String {
         self.name.clone()
@@ -296,5 +315,7 @@ impl ProjectNameEntity for EntyClass {
 
     // #UpdateOp
 
+    // #PatchOp
+
     // #RemoveOp
 }

package/project/.sdk/src/cmp/rust/fragment/EntityPatchOp.fragment.rs

@@ -0,0 +1,41 @@
+// EJECT-START
+
+fn patch(self: &Rc<Self>, reqdata: Value, ctrl: Value) -> Result<Rc<Self>, ProjectNameError> {
+    let ctx = self.utility.make_context(
+        CtxSpec {
+            opname: Some("patch".to_string()),
+            ctrl: Some(ctrl),
+            mtch: Some(self.mtch.borrow().clone()),
+            data: Some(self.data.borrow().clone()),
+            reqdata: Some(reqdata),
+            ..Default::default()
+        },
+        Some(&self.ent_ctx()),
+    );
+
+    self.run_op(&ctx, &|ctx| {
+        if let Some(result) = ctx.result.borrow().clone() {
+            let (resmatch, resdata) = {
+                let r = result.borrow();
+                (r.resmatch.clone(), r.resdata.clone())
+            };
+            if let Value::Map(_) = resmatch {
+                *self.mtch.borrow_mut() = resmatch;
+            }
+            if !resdata.is_noval() && !resdata.is_null() {
+                *self.data.borrow_mut() = match to_map(&vs::clone(&resdata)) {
+                    Value::Map(m) => Value::Map(m),
+                    _ => Value::empty_map(),
+                };
+            }
+        }
+    })?;
+
+    // The operation resolves to THIS entity: `run_op` has just absorbed the
+    // result into it, and the caller reaches the record through `.data(None)`.
+    // See AGENTS.md "Entity operations return ENTITIES".
+
+    Ok(self.clone())
+}
+
+// EJECT-END

package/project/.sdk/src/cmp/rust/fragment/Main.fragment.rs

@@ -6,7 +6,7 @@ use std::rc::Rc;
 use crate::core::config::{make_feature, shared_config};
 use crate::core::context::{Context, CtxSpec};
 use crate::core::error::ProjectNameError;
-use crate::core::helpers::{call_json, get_bool, get_str, getp, getpath, jo, setp, to_int, to_map};
+use crate::core::helpers::{allowed, call_json, get_bool, get_str, getp, getpath, jo, setp, to_int, to_map};
 use crate::core::spec::Spec;
 use crate::core::types::FeatureRef;
 use crate::core::utility_type::Utility;
@@ -134,7 +134,23 @@ impl ProjectNameSDK {
         let path = get_str(&fetchargs, "path").unwrap_or_default();
         let method = get_str(&fetchargs, "method")
             .filter(|m| !m.is_empty())
-            .unwrap_or_else(|| "GET".to_string());
+            .unwrap_or_else(|| "GET".to_string())
+            .to_uppercase();
+
+        let allow_method = getpath(&["allow", "method"], &options);
+        if !allowed(&allow_method, &method) {
+            return Err(ctx.make_error(
+                "spec_method_allow",
+                &format!(
+                    "Method \"{}\" not allowed by SDK option allow.method value: \"{}\"",
+                    method,
+                    match &allow_method {
+                        Value::Str(s) => s.as_str(),
+                        _ => "",
+                    }
+                ),
+            ));
+        }
 
         let params = match to_map(&getp(&fetchargs, "params")) {
             Value::Map(m) => Value::Map(m),
@@ -188,10 +204,7 @@ impl ProjectNameSDK {
 
     // Is this raw-access op permitted by the SDK's allow.op option?
     fn op_allowed(&self, op: &str) -> bool {
-        match getpath(&["allow", "op"], &self.options_map()) {
-            Value::Str(s) => s.contains(op),
-            _ => false,
-        }
+        allowed(&getpath(&["allow", "op"], &self.options_map()), op)
     }
 
     fn op_denied(&self, op: &str) -> Value {
@@ -282,12 +295,29 @@ impl ProjectNameSDK {
                 }
             };
 
-            return Ok(jo(vec![
-                ("ok", Value::Bool((200..300).contains(&status))),
+            let body_err = if !no_body && getp(&fetched, "unreadable") == Value::Bool(true) {
+                let failed = if (200..300).contains(&status) {
+                    None
+                } else {
+                    Some(ctx.make_error("request_status", &format!("request: {}: {}", status,
+                        get_str(&fetched, "statusText").unwrap_or_default())))
+                };
+                Some(crate::core::response::unreadable_body(&ctx, status, &headers,
+                    &getp(&fetched, "body"), &getp(&fetchdef, "headers"), failed))
+            } else {
+                None
+            };
+
+            let mut out = vec![
+                ("ok", Value::Bool(body_err.is_none() && (200..300).contains(&status))),
                 ("status", Value::Num(status as f64)),
                 ("headers", headers),
                 ("data", json_data),
-            ]));
+            ];
+            if let Some(err) = body_err {
+                out.push(("err", Value::str(utility.clean_str(&ctx, &err.msg))));
+            }
+            return Ok(jo(out));
         }
 
         Ok(jo(vec![

package/project/.sdk/src/cmp/rust/utility_rust.ts

@@ -4,7 +4,7 @@ import {
   walk,
 } from '@voxgig/struct'
 
-import { sdkName } from '@voxgig/sdkgen'
+import { sdkName, canonScalarKey, requiredItems } from '@voxgig/sdkgen'
 
 
 // Rust keywords (strict + reserved) that are illegal as an identifier.
@@ -150,7 +150,19 @@ function rustRawString(s: string): string {
   return 'r' + hashes + '"' + s + '"' + hashes
 }
 
+// A list's required route and query parameters, as the match it is called with.
+function rustListMatch(entity: any): string {
+  const lit = (type: any): string =>
+    (({ NULL: 'Value::Null', INTEGER: 'Value::Num(1.0)', NUMBER: 'Value::Num(1.0)', BOOLEAN: 'Value::Bool(true)', ARRAY: 'Value::empty_list()', OBJECT: 'Value::empty_map()' }) as any)[canonScalarKey(type)] ?? 'Value::str("example")'
+  const items = requiredItems(entity, 'list')
+  return 0 < items.length
+    ? `jo(vec![${items.map((it: any) => `(${JSON.stringify(it.name)}, ${lit(it.type)})`).join(', ')}])`
+    : 'Value::Noval'
+}
+
+
 export {
+  rustListMatch,
   rustMethodName,
   rustRawString,
   clean,

package/project/.sdk/src/cmp/scala/Config_scala.ts

@@ -92,6 +92,10 @@ const Config = cmp(async function Config(props: any) {
   const options: Record<string, any> = {
     base: baseUrl,
   }
+  // The declared defaults makeOptions fills a templated base URL from.
+  if (null != configDef.options.server) {
+    options.server = configDef.options.server
+  }
   if (authActive) {
     const auth: Record<string, any> = { prefix: authPrefix }
     if (authBasic) auth.basic = true

package/project/.sdk/src/cmp/scala/EntityTypes_scala.ts

@@ -30,8 +30,9 @@ const SCALA_KEYWORDS = new Set<string>([
 ])
 
 
+// A bare `_` is the wildcard, backquoted or not.
 function scalaIdent(name: string): boolean {
-  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) && !SCALA_KEYWORDS.has(name)
+  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) && !SCALA_KEYWORDS.has(name) && '_' !== name
 }
 
 
@@ -66,8 +67,10 @@ function emitCaseClass(typeName: string, items: any[], log?: any): void {
     return
   }
 
+  // A name ending in `_` lexes with the colon after it as one identifier.
   const params = usable
-    .map((it: any) => `${it.name}: ${canonToType(it.type, LANG)}`)
+    .map((it: any) => `${it.name.endsWith('_') ? '`' + it.name + '`' : it.name}: ` +
+      canonToType(it.type, LANG))
     .join(', ')
   Content(`  final case class ${typeName}(${params})
 
@@ -127,7 +130,7 @@ object ${model.const.Name}Types {
       })), log)
 
       const ops = ent.op || {}
-      ;['load', 'list', 'create', 'update', 'remove'].forEach((opname: string) => {
+      ;['load', 'list', 'create', 'update', 'patch', 'remove'].forEach((opname: string) => {
         if (null == ops[opname]) {
           return
         }

package/project/.sdk/src/cmp/scala/Entity_scala.ts

@@ -45,7 +45,7 @@ const Entity = cmp(function Entity(props: any) {
       // implementation. Otherwise emit a stub that satisfies the SdkEntity
       // contract (so the package compiles) but errors at runtime.
       const opfrags =
-        (['load', 'list', 'create', 'update', 'remove']
+        (['load', 'list', 'create', 'update', 'patch', 'remove']
           .reduce((a: any, opname: string) =>
           (a['// #' + camelify(opname) + 'Op'] =
             !opnames.includes(opname) ?

package/project/.sdk/src/cmp/scala/Main_scala.ts

@@ -5,6 +5,7 @@ import {
   cmp, each,
   File, Content, Copy, Folder, Fragment,
   targetFeatures,
+  inactiveFeatureExcludes,
   pluginExcludes,
   TEST_CONTROL_EXCLUDE
 } from '@voxgig/sdkgen'
@@ -38,31 +39,14 @@ const Main = cmp(async function Main(props: any) {
   const { model } = props.ctx$
 
   const entity: ModelEntity = getModelPath(model, `main.${KIT}.entity`)
-  // Gated by the applicability tags, so this target never imports or
-  // registers a feature it has no source for. One rule, one place:
-  // helpers/applicability.
+  // Gated by the applicability tags, so this target never names a feature it
+  // has no source for (helpers/applicability).
   const feature = targetFeatures(model, target)
 
   // The Scala package root for every runtime piece (like GOMODULE for go).
   const scalapackage = scalaPackage(model)
 
   const esc = (s: string) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
-  const allfeature = getModelPath(model, `main.${KIT}.feature`,
-    { required: false, only_active: false }) || {}
-  const inactivePluginExcludes: RegExp[] = []
-  for (const fname of Object.keys(allfeature)) {
-    if (null != (feature as any)[fname]) continue
-    const groups = getModelPath(model, `main.${KIT}.feature.${fname}.plugin`,
-      { required: false, only_active: false }) || {}
-    for (const gname of Object.keys(groups)) {
-      for (const one of (groups[gname].path || [])) {
-        const pat = esc(String(one))
-        inactivePluginExcludes.push(new RegExp('(^|/)' +
-          pat.replace(/\\\/$/, '') + (/\/$/.test(String(one)) ? '/' : '$')))
-      }
-    }
-  }
-
   const SHARED_SEKRETO_PLUGINS = ['Httpjson.scala', 'Sigv4.scala']
   const pluginDirExcludes: RegExp[] = []
   if (null == (feature as any).secrets) {
@@ -83,8 +67,8 @@ const Main = cmp(async function Main(props: any) {
     exclude: [
       /src\//,
       TEST_CONTROL_EXCLUDE,
+      ...inactiveFeatureExcludes(props.ctx$, target),
       ...pluginExcludes(model),
-      ...inactivePluginExcludes,
       ...pluginDirExcludes,
     ],
     replace: {